bash-classify 0.4.1__tar.gz → 0.5.0__tar.gz

{bash_classify-0.4.1 → bash_classify-0.5.0}/.claude-plugin/marketplace.json

@@ -8,7 +8,7 @@
     {
       "name": "bash-classify-hook",
       "description": "Auto-allows low-risk bash commands in Claude Code using bash-classify",
-      "version": "0.4.1",
+      "version": "0.5.0",
       "author": {
         "name": "Filip Procházka",
         "url": "https://github.com/fprochazka"

{bash_classify-0.4.1 → bash_classify-0.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bash-classify
-Version: 0.4.1
+Version: 0.5.0
 Summary: Classify bash commands as READONLY, WRITE, DANGEROUS, or UNKNOWN
 Project-URL: Homepage, https://github.com/fprochazka/bash-classify
 Project-URL: Repository, https://github.com/fprochazka/bash-classify

{bash_classify-0.4.1 → bash_classify-0.5.0}/SPEC.md

@@ -246,7 +246,21 @@ Certain expression-level patterns elevate risk to at least `HIGH`:
 - Writing to system paths (e.g. `/etc`, `/usr`)
 - Redirecting to `/dev/tcp` or `/dev/udp`
 - Backgrounding (`cmd &`)
-- Output redirects to non-`/dev/null` targets
+- Output redirects to non-`/dev/null` targets (except when all write targets are under `/tmp` or `/var/tmp`)
+
+#### Temp path risk lowering
+
+When all write targets from output redirects (`>`, `>>`, `2>`, `&>`, `>&`) are under `/tmp` or `/var/tmp`, the risk elevation to `MEDIUM` from output redirects is skipped. This allows commands like `cat > /tmp/foo.txt` to remain at `LOW` risk while still being classified as `LOCAL_EFFECTS`.
+
+### File path detection
+
+The tool extracts file paths from shell redirects:
+
+- **`write_paths`**: Files targeted by output redirects (`>`, `>>`, `2>`, `&>`, `>&`), excluding `/dev/null`, `/dev/stdin`, `/dev/stdout`, `/dev/stderr`, and `/dev/fd/*`.
+- **`read_paths`**: Files targeted by input redirects (`<`), excluding the same `/dev/*` paths.
+- Heredoc operators (`<<`, `<<<`) are not included — their target is a delimiter, not a file path.
+
+Paths are reported at both the per-command level (`commands[].write_paths`, `commands[].read_paths`) and the expression level (aggregated from all commands).
 
 ### Composite classification
 
@@ -918,6 +932,8 @@ The `commands` list is recursive — any command entry can contain `inner_comman
   "expression": "string — the original input",
   "classification": "READONLY | LOCAL_EFFECTS | EXTERNAL_EFFECTS | DANGEROUS | UNKNOWN",
   "directories": ["string — detected directories"],
+  "write_paths": ["string — files targeted by output redirects (optional, omitted when empty)"],
+  "read_paths": ["string — files targeted by input redirects (optional, omitted when empty)"],
   "commands": [
     {
       "command": ["string — binary + subcommand chain (without inner command tokens)"],
@@ -928,6 +944,8 @@ The `commands` list is recursive — any command entry can contain `inner_comman
       "remaining_options": ["string — options that were not in database"],
       "classification_reason": "string — why this classification was chosen",
       "overriding_option": "string | null — the option that elevated classification",
+      "write_paths": ["string — files targeted by output redirects (optional, omitted when empty)"],
+      "read_paths": ["string — files targeted by input redirects (optional, omitted when empty)"],
       "inner_commands": [
         {
           "delegation_mode": "string — how this inner command was extracted",

{bash_classify-0.4.1 → bash_classify-0.5.0}/coding-agent-plugins/claude-code/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "bash-classify-hook",
-  "version": "0.4.1",
+  "version": "0.5.0",
   "description": "Auto-allows low-risk bash commands in Claude Code using bash-classify",
   "author": {
     "name": "Filip Prochazka"

{bash_classify-0.4.1 → bash_classify-0.5.0}/docs/classification-guidance.md

@@ -453,7 +453,15 @@ subcommands:
 - Unrecognized goals (e.g. custom Maven plugin goals like `some-plugin:goal`) fall back to the command's base classification and risk
 - Option overrides (e.g. `--dry-run`) still take precedence over goal aggregation
 
-## 10. Common Patterns
+## 10. Temp Path Risk Behavior
+
+When a command writes to a file via output redirects (`>`, `>>`, `2>`, `&>`, `>&`), its risk is normally elevated to at least `MEDIUM`. However, if **all** write targets are under `/tmp` or `/var/tmp`, the risk elevation is skipped and the command stays at `LOW` risk (assuming no other risk elevations apply).
+
+This means `cat > /tmp/foo.txt` is classified as `LOCAL_EFFECTS` with risk `LOW`, while `cat > ~/foo.txt` is classified as `LOCAL_EFFECTS` with risk `MEDIUM`.
+
+The tool also reports `write_paths` and `read_paths` in the output, extracted from redirect operators. These fields are omitted from the JSON output when empty.
+
+## 11. Common Patterns
 
 | Pattern | Example | Classification |
 |---------|---------|---------------|

{bash_classify-0.4.1 → bash_classify-0.5.0}/src/bash_classify/classifier.py

@@ -48,6 +48,22 @@ _SAFE_PREFIXES = (
     "/dev/udp",
 )
 
+_WRITE_OPERATORS = {">", ">>", "2>", "&>", ">&"}
+_READ_OPERATORS = {"<"}
+_HEREDOC_OPERATORS = {"<<", "<<<"}
+
+_DEV_PATHS = ("/dev/null", "/dev/stdin", "/dev/stdout", "/dev/stderr", "/dev/fd/")
+
+
+def _is_temp_path(path: str) -> bool:
+    """Check if a path is under a temp directory."""
+    return path.startswith("/tmp/") or path == "/tmp" or path.startswith("/var/tmp/") or path == "/var/tmp"
+
+
+def _is_real_file_path(path: str) -> bool:
+    """Check if a redirect target is a real file path (not /dev/null etc)."""
+    return all(not (path == dev or path.startswith(dev)) for dev in _DEV_PATHS)
+
 
 def _is_system_path(path: str) -> bool:
     """Check if a path is a system directory that should trigger DANGEROUS when written to."""
@@ -103,6 +119,20 @@ def classify_expression(
         else:
             result = match_command(invocation, database)
 
+        # Collect file paths from redirects
+        write_paths: list[str] = []
+        read_paths: list[str] = []
+        all_write_targets_are_temp = True
+
+        for redirect in invocation.redirects:
+            if redirect.operator in _WRITE_OPERATORS and _is_real_file_path(redirect.target):
+                write_paths.append(redirect.target)
+                if not _is_temp_path(redirect.target):
+                    all_write_targets_are_temp = False
+            elif redirect.operator in _READ_OPERATORS and _is_real_file_path(redirect.target):
+                read_paths.append(redirect.target)
+            # Skip << and <<< (heredoc/herestring - target is delimiter, not file)
+
         # Step 4: Apply redirect classification
         for redirect in invocation.redirects:
             if redirect.affects_classification:
@@ -114,8 +144,9 @@ def classify_expression(
                         if result.classification_reason
                         else "elevated by output redirect"
                     )
-                # Elevate risk to at least MEDIUM for output redirects
-                result.risk = Risk.max_severity(result.risk, Risk.MEDIUM)
+                # Only elevate risk if write targets are NOT all temp paths
+                if not (write_paths and all_write_targets_are_temp):
+                    result.risk = Risk.max_severity(result.risk, Risk.MEDIUM)
             # /dev/tcp and /dev/udp redirects are network access -> DANGEROUS
             if redirect.target.startswith("/dev/tcp/") or redirect.target.startswith("/dev/udp/"):
                 elevated = Classification.max_severity(result.classification, Classification.DANGEROUS)
@@ -165,12 +196,24 @@ def classify_expression(
                 ) + f"; elevated to DANGEROUS: system path {system_paths_found[0]}"
                 result.risk = Risk.HIGH
 
+        result.write_paths = write_paths if write_paths else None
+        result.read_paths = read_paths if read_paths else None
+
         command_results.append(result)
         all_redirects.extend(invocation.redirects)
 
     # Step 7: Collect directories
     directories = _collect_directories(command_results)
 
+    # Step 7b: Aggregate write_paths and read_paths
+    all_write_paths: list[str] = []
+    all_read_paths: list[str] = []
+    for cmd_result in command_results:
+        if cmd_result.write_paths:
+            all_write_paths.extend(cmd_result.write_paths)
+        if cmd_result.read_paths:
+            all_read_paths.extend(cmd_result.read_paths)
+
     # Step 8: Compute composite classification and risk
     if not command_results and parse_warnings:
         overall = Classification.UNKNOWN
@@ -187,6 +230,8 @@ def classify_expression(
         classification=overall,
         risk=overall_risk,
         directories=directories,
+        write_paths=all_write_paths,
+        read_paths=all_read_paths,
         commands=command_results,
         redirects=all_redirects,
         parse_warnings=parse_warnings,

{bash_classify-0.4.1 → bash_classify-0.5.0}/src/bash_classify/cli.py

@@ -57,6 +57,11 @@ def _command_to_dict(result: CommandResult) -> dict:
     if result.overriding_option is not None:
         d["overriding_option"] = result.overriding_option
 
+    if result.write_paths:
+        d["write_paths"] = result.write_paths
+    if result.read_paths:
+        d["read_paths"] = result.read_paths
+
     d["inner_commands"] = [_inner_command_to_dict(ic) for ic in result.inner_commands]
 
     return d
@@ -81,6 +86,11 @@ def _result_to_dict(result: ExpressionResult) -> dict:
         "commands": [_command_to_dict(cmd) for cmd in result.commands],
     }
 
+    if result.write_paths:
+        d["write_paths"] = result.write_paths
+    if result.read_paths:
+        d["read_paths"] = result.read_paths
+
     if result.redirects:
         d["redirects"] = [_redirect_to_dict(r) for r in result.redirects]
 

{bash_classify-0.4.1 → bash_classify-0.5.0}/src/bash_classify/commands/pup.yaml

@@ -13,8 +13,10 @@ subcommands:
 
   apm:
     classification: READONLY
+    strict: false
   audit-logs:
     classification: READONLY
+    strict: false
   auth:
     classification: LOCAL_EFFECTS
     strict: false
@@ -33,76 +35,112 @@ subcommands:
         classification: LOCAL_EFFECTS
   cloud:
     classification: READONLY
+    strict: false
   containers:
     classification: READONLY
+    strict: false
   cost:
     classification: READONLY
+    strict: false
   dbm:
     classification: READONLY
+    strict: false
   ddsql:
     classification: READONLY
+    strict: false
   error-tracking:
     classification: READONLY
+    strict: false
   events:
     classification: READONLY
+    strict: false
   fleet:
     classification: READONLY
+    strict: false
   infrastructure:
     classification: READONLY
+    strict: false
   llm-obs:
     classification: READONLY
+    strict: false
   logs:
     classification: READONLY
+    strict: false
   on-call:
     classification: READONLY
+    strict: false
   organizations:
     classification: READONLY
+    strict: false
   rum:
     classification: READONLY
+    strict: false
   scorecards:
     classification: READONLY
+    strict: false
   service-catalog:
     classification: READONLY
+    strict: false
   static-analysis:
     classification: READONLY
+    strict: false
   status-pages:
     classification: READONLY
+    strict: false
   symdb:
     classification: READONLY
+    strict: false
   synthetics:
     classification: READONLY
+    strict: false
   traces:
     classification: READONLY
+    strict: false
   usage:
     classification: READONLY
+    strict: false
   users:
     classification: READONLY
+    strict: false
   version:
     classification: READONLY
+    strict: false
   status:
     classification: READONLY
+    strict: false
   completions:
     classification: READONLY
+    strict: false
   test-optimization:
     classification: READONLY
+    strict: false
   code-coverage:
     classification: READONLY
+    strict: false
   cicd:
     classification: READONLY
+    strict: false
   product-analytics:
     classification: READONLY
+    strict: false
   data-governance:
     classification: READONLY
+    strict: false
   feature-flags:
     classification: READONLY
+    strict: false
   bits:
     classification: READONLY
+    strict: false
   hamr:
     classification: READONLY
+    strict: false
   misc:
     classification: READONLY
+    strict: false
   agent:
     classification: READONLY
+    strict: false
 
 
   monitors:

{bash_classify-0.4.1 → bash_classify-0.5.0}/src/bash_classify/commands/tee.yaml

@@ -2,6 +2,7 @@
 command: tee
 description: "Read from stdin and write to stdout and files"
 classification: LOCAL_EFFECTS
+risk: LOW
 strict: false
 global_options:
   --help: {overrides: READONLY}

{bash_classify-0.4.1 → bash_classify-0.5.0}/src/bash_classify/models.py

@@ -177,6 +177,8 @@ class CommandResult:
     classification_reason: str | None = None
     overriding_option: str | None = None
     directories: list[str] | None = None
+    write_paths: list[str] | None = None
+    read_paths: list[str] | None = None
 
 
 @dataclass
@@ -187,6 +189,8 @@ class ExpressionResult:
     classification: Classification
     risk: Risk
     directories: list[str]
+    write_paths: list[str]
+    read_paths: list[str]
     commands: list[CommandResult]
     redirects: list[Redirect]
     parse_warnings: list[str]

{bash_classify-0.4.1 → bash_classify-0.5.0}/tests/test_classifier.py

@@ -631,3 +631,59 @@ class TestRiskExpressionAggregation:
         result = classify_expression("if then fi", database=database)
         assert result.classification == Classification.UNKNOWN
         assert result.risk == Risk.HIGH
+
+
+class TestFilePathDetection:
+    """Tests for write_paths/read_paths detection and temp path risk lowering."""
+
+    def test_write_to_tmp_stays_low_risk(self, database: dict[str, CommandDef]) -> None:
+        result = classify_expression("cat > /tmp/foo.txt", database=database)
+        assert result.classification == Classification.LOCAL_EFFECTS
+        assert result.risk == Risk.LOW
+        assert result.write_paths == ["/tmp/foo.txt"]
+        cmd = result.commands[0]
+        assert cmd.write_paths == ["/tmp/foo.txt"]
+
+    def test_write_to_var_tmp_stays_low_risk(self, database: dict[str, CommandDef]) -> None:
+        result = classify_expression("cat > /var/tmp/foo.txt", database=database)
+        assert result.classification == Classification.LOCAL_EFFECTS
+        assert result.risk == Risk.LOW
+        assert result.write_paths == ["/var/tmp/foo.txt"]
+
+    def test_write_to_home_elevates_risk(self, database: dict[str, CommandDef]) -> None:
+        result = classify_expression("cat > /home/user/foo.txt", database=database)
+        assert result.classification == Classification.LOCAL_EFFECTS
+        assert result.risk == Risk.MEDIUM
+        assert result.write_paths == ["/home/user/foo.txt"]
+
+    def test_mixed_tmp_and_home_elevates_risk(self, database: dict[str, CommandDef]) -> None:
+        # Two redirects: one temp, one not -- should elevate
+        result = classify_expression("echo hello > /tmp/a.txt > /home/user/b.txt", database=database)
+        assert result.risk == Risk.MEDIUM
+
+    def test_read_redirect_detected(self, database: dict[str, CommandDef]) -> None:
+        result = classify_expression("cat < /home/user/data.txt", database=database)
+        assert result.classification == Classification.READONLY
+        assert result.risk == Risk.LOW
+        assert result.read_paths == ["/home/user/data.txt"]
+        assert result.write_paths == []
+
+    def test_read_and_write_redirect(self, database: dict[str, CommandDef]) -> None:
+        result = classify_expression("sort < /home/user/hosts > /tmp/sorted.txt", database=database)
+        assert result.classification == Classification.LOCAL_EFFECTS
+        assert result.risk == Risk.LOW
+        assert result.write_paths == ["/tmp/sorted.txt"]
+        assert result.read_paths == ["/home/user/hosts"]
+
+    def test_dev_null_excluded_from_write_paths(self, database: dict[str, CommandDef]) -> None:
+        result = classify_expression("cat > /dev/null", database=database)
+        assert result.write_paths == []
+
+    def test_heredoc_not_in_read_paths(self, database: dict[str, CommandDef]) -> None:
+        result = classify_expression("cat << EOF\nhello\nEOF", database=database)
+        assert result.read_paths == []
+
+    def test_expression_level_aggregation(self, database: dict[str, CommandDef]) -> None:
+        result = classify_expression("cat < /home/user/data.txt | tee /tmp/out.txt > /tmp/log.txt", database=database)
+        assert "/home/user/data.txt" in result.read_paths
+        assert "/tmp/log.txt" in result.write_paths

{bash_classify-0.4.1 → bash_classify-0.5.0}/tests/test_cli_serialization.py

@@ -129,6 +129,8 @@ class TestResultToDict:
             classification=Classification.EXTERNAL_EFFECTS,
             risk=Risk.MEDIUM,
             directories=[],
+            write_paths=[],
+            read_paths=[],
             commands=[cmd],
             redirects=[redirect],
             parse_warnings=["some warning"],
@@ -155,6 +157,8 @@ class TestResultToDict:
             classification=Classification.READONLY,
             risk=Risk.LOW,
             directories=[],
+            write_paths=[],
+            read_paths=[],
             commands=[cmd],
             redirects=[],
             parse_warnings=[],
@@ -238,6 +242,8 @@ class TestRiskSerialization:
             classification=Classification.READONLY,
             risk=Risk.LOW,
             directories=[],
+            write_paths=[],
+            read_paths=[],
             commands=[cmd],
             redirects=[],
             parse_warnings=[],
@@ -259,3 +265,96 @@ class TestRiskSerialization:
             d = _command_to_dict(result)
             assert d["risk"] == risk.value
             assert isinstance(d["risk"], str)
+
+
+class TestWriteReadPaths:
+    def test_write_paths_in_command_dict(self) -> None:
+        result = CommandResult(
+            command=["cat"],
+            argv=["cat"],
+            classification=Classification.LOCAL_EFFECTS,
+            risk=Risk.LOW,
+            matched_rule="cat",
+            inner_commands=[],
+            write_paths=["/tmp/foo.txt"],
+        )
+        d = _command_to_dict(result)
+        assert d["write_paths"] == ["/tmp/foo.txt"]
+        assert "read_paths" not in d
+
+    def test_read_paths_in_command_dict(self) -> None:
+        result = CommandResult(
+            command=["cat"],
+            argv=["cat"],
+            classification=Classification.READONLY,
+            risk=Risk.LOW,
+            matched_rule="cat",
+            inner_commands=[],
+            read_paths=["/etc/hosts"],
+        )
+        d = _command_to_dict(result)
+        assert d["read_paths"] == ["/etc/hosts"]
+        assert "write_paths" not in d
+
+    def test_paths_omitted_when_empty(self) -> None:
+        result = CommandResult(
+            command=["ls"],
+            argv=["ls"],
+            classification=Classification.READONLY,
+            risk=Risk.LOW,
+            matched_rule="ls",
+            inner_commands=[],
+        )
+        d = _command_to_dict(result)
+        assert "write_paths" not in d
+        assert "read_paths" not in d
+
+    def test_expression_write_read_paths(self) -> None:
+        cmd = CommandResult(
+            command=["cat"],
+            argv=["cat"],
+            classification=Classification.LOCAL_EFFECTS,
+            risk=Risk.LOW,
+            matched_rule="cat",
+            inner_commands=[],
+            write_paths=["/tmp/out.txt"],
+            read_paths=["/etc/hosts"],
+        )
+        result = ExpressionResult(
+            expression="cat < /etc/hosts > /tmp/out.txt",
+            classification=Classification.LOCAL_EFFECTS,
+            risk=Risk.LOW,
+            directories=[],
+            write_paths=["/tmp/out.txt"],
+            read_paths=["/etc/hosts"],
+            commands=[cmd],
+            redirects=[],
+            parse_warnings=[],
+        )
+        d = _result_to_dict(result)
+        assert d["write_paths"] == ["/tmp/out.txt"]
+        assert d["read_paths"] == ["/etc/hosts"]
+
+    def test_expression_paths_omitted_when_empty(self) -> None:
+        cmd = CommandResult(
+            command=["ls"],
+            argv=["ls"],
+            classification=Classification.READONLY,
+            risk=Risk.LOW,
+            matched_rule="ls",
+            inner_commands=[],
+        )
+        result = ExpressionResult(
+            expression="ls",
+            classification=Classification.READONLY,
+            risk=Risk.LOW,
+            directories=[],
+            write_paths=[],
+            read_paths=[],
+            commands=[cmd],
+            redirects=[],
+            parse_warnings=[],
+        )
+        d = _result_to_dict(result)
+        assert "write_paths" not in d
+        assert "read_paths" not in d